In 2025, nearly 3 in 10 security professionals thought that fully autonomous AI systems could satisfy their companies’ security-testing needs. But after a year of testing and experimentation, that optimism has largely gone away. Instead, chief information security officers (CISOs) and other security practitioners have more realistic expectations of the AI-based systems, which often have significant blind spots, are prone to false positives, and can blow through AI budgets, according to a June 25 report released by Cobalt, a penetration-testing-as-a-service firm. The number of organizations willing to rely on AI-powered penetration testing for their security needs fell to 9% in 2026, down from 29% a year earlier. The vast majority of companies preferred a hybrid, human-in-the-loop approach or relegating only non-critical tasks to automation.

Full report : Companies are still experimenting with automated AI systems to find security weaknesses, but fewer are relying on the technology.